Hitachi Energy CoreTec Product

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-302-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Hitachi Energy is aware of OS command injection and Dirty Frag vulnerabilities that affect CoreTec product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.</strong></p> <p>The following versions of Hitachi Energy CoreTec Product are affected:</p> <ul> <li>CoreTec5 vers:CoreTec5/&lt;=3.4.0, 5.0.0 (CVE-2026-13162, CVE-2026-43284)</li> <li>CoreTec4 vers:CoreTec4/&lt;=3.4.0 (CVE-2026-13162)</li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> <thead> <tr> <th role="columnheader" data-tablesaw-priority="persist">CVSS</th> <th role="columnheader">Vendor</th> <th role="columnheader">Equipment</th> </tr> </thead> <tbody> <tr> <td>v3 8.8</td> <td>Hitachi Energy</td> <td>CoreTec5</td> </tr> </tbody> </table> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> <thead> <tr> <th role="columnheader" data-tablesaw-priority="persist">2 Vulnerabilities</th> </tr> </thead> <tbody> <tr> <td>Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Write-what-where Condition</td> </tr> </tbody> </table> </div> <h3>Background</h3> <ul> <li><strong>Critical Infrastructure Sectors: </strong>Energy</li> <li><strong>Countries/Areas Deployed: </strong>Worldwide</li> <li><strong>Company Headquarters Location: </strong>Switzerland</li> </ul> <hr> <h2>Vulnerabilities</h2> <div class="icsa-etb-toggle-wrapper"><a class="icsa-etb-toggle-all" href="#">Expand All +</a></div> <div class="c-expandable-textbox icsa-etb"> <div class="c-expandable-textbox__title">CVE-2026-13162</div> <